Hi all,
I've been monitoring the list for the past few days now. Hearing (well,
reading) everyone with all
the different types of solutions and arguments brings me to the following
concept. Although its far
from covering everything, there are still some lose ends, I think its a good
starting point.
Although spam should be (and in most countries is) illegal, that's not going to
stop it. As long as
there are countries that are more flexible to spammers, it will be hard to get
them before court.
Which ultimately leads to conclude that the law is not going to be able to
solve this. So any
discussion whether it should be more illegal or not, heavier punishments or
cheaper ways to bring a
spammer to justice will not make spam go away. In other words, a futile
discussion.
Since justice needs a person or organization to stand trial, what we need to do
first is find out
who is spamming in a legal way. Then Justice can take place much more easily.
Content filtering is (as has been pointed out before) ultimately an enduser
solution. As email can
be encrypted (although encrypted spam is hardly very likely) it becomes
difficult for an automated
process to be checked. Besides, the same content can sometimes be wanted and
sometimes be spam (as
has also been described in emails from others on the list). If I like to write
dirty to my
girlfriend, that is not spam. However, if it is to thousands of users around
the world that I do
not know, that would make it spam for most, although there might still be a few
who would want that
kind of mail...
Systems that rely on remote systems setting tags, or having certificates are
also not very reliable
in the end. They can be forged. If a spammer has its own mailserver, it can
forge any tag that is
invented to prevent spam.
Seperation of spam and legitimate mail must be close to 100%. Something like
99.99999%. If on a
billion mails only one gets lost, that's acceptable to me. Furthermore, the
traffic spam consumes
must be reduced to its absoluut minimum. Determining if an email is spam can
only be done at the
receiving side on the server or on the client. A spammer can be a legitimate
sender at one time,
and a spammer at another.
Which ultimately leads me to the conclusion that the receiving mailserver
should be the first place
to start. This is the place where the spammer has no control over. If he knocks
on my door and
doesn't know the password, I can simply keep the door locked. Whatever
authentication or
certification my mailserver wants to receive an email, the spammer will have to
comply to. (As long
as my security on the server is sound of course...But even then, if security is
low, the spammer
will have to be a hacker as well, totally different skills, and much more
timeconsuming).
So the question is probably, how do we do that?
Firstly, I want my mailserver to garantee the sender. That will give me much
more control.
The server could do this as follows: whenever a remote mailserver sends an
email to a receiving
mailserver, the receiving mailserver should lookup the domain of which the
sender claims the email
is from, contact the mailserver of that domain, and check it is actually trying
to send the email.
This will garantee the source to my mailserver, giving me full control over the
check. It will be
very difficult for the spammer to forge this.
Now a problem rises for users that send from a mailserver that's is not part of
the source domain.
Like mobile users sending mail from their hotelroom, home users sending with an
office
emailaddress, etc. This can be solved by informing the mailserver of the domain
in the FROM field
that a message is being send. Basically, you could send the header of the email
which will provide
enough information. For this to happen reliably, the user would have to login
to the mailserver. In
the end, if the mailserver of the domain in the FROM field is not notified, the
sender will not be
able to get the email to me.
So now that I know the source, I could setup a list of users on the mailserver
that are save.
Whenever the mailserver receives an email for me, it'll check against the list
of known addresses.
If the sending party is in my list, the email can go right to my mailbox. If
not, additional action
is needed (and has to be defined). Very safe, and without too much need for
server resources.
I can still send email from anywhere in the world to anyone. Thus, I can create
a whitelist of
folks whom I trust. Of course, I would need to setup all my emailboxes with the
necessary filters.
This mechanisme ensures that an email can be traced back to the sending domain,
it has to have a
valid sending emailaddress of which the domainname is registered in DNS and the
authorized
mailserver of that domain must have send the email.
If more mailservers exists within the sending domain, it is likely that the
receiving mailserver
connects to a different mailserver from the sending domain. So there also has
to be a mechanisme
for the sending mailservers to communicate amongst each other. Basically, it
should do a sort of
broadcast to is fellow mailservers of the domain, and ask if anyone is sending
the email.
Since we now know who is sending the spam (forging emailaddresses just became
much more difficult)
we can put up a blacklist with known spammers. An email server should be able
to either mirror it
in case the blacklist goes down (due to a DoS attack of some sort) or use it
realtime. Every user
should have an option somewhere, in its client, thru a website of the ISP,
whatever, to select a
particular blacklist and tell the emailserver to use that list or lists for the
users mailbox. The
email server will first use the users whitelist, and then the blacklist.
If a user considers an email spam, it should be able to reply the email and
sent it out again,
using a special tag in the subject stating SPAM or something. The email server
will pick this up
and instead of sending the reply to the spammer (though he might get perhaps a
copy?) it will sent
it to the blacklist.
If the sending address gets, say, twenty emails from different persons stating
the sender is a
spammer, it could be added to the list.
Spammers who use a temporary hotmail account might still form a problem, but
they will not be able
to send email using that account if they do not notify the hotmail emailserver.
Webmail accounts
usually can only be used from a webpage which sends the email using an unknown
(to the sender)
mailserver. I have a feeling spammers are not going to use a webpage to
construct thousands of
email spam....
Remember, this is just a thought (though a long one...) of how it could be
done. The above
described method can be slowly implemented in the existing systems. If users
also authenticate to
SMTP servers, the ISP or administrator can also make sure no unauthorised
person gets to use the
mailserver. In the end, it will make spamming a whole lot harder.
Happy thinking!
Olger Diekstra.
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg